WordPress ReviewX Plugin <= 1.6.27 is vulnerable to Broken Access Control

Software ReviewX Type Plugin Vulnerable versions = 1.6.27 Fixed in 1.6.28 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3609 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ba8ab4855491 Credits Lucio Sá Required privilege Subscrib...

WordPress Mega Elements Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Mega Elements Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4702 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ecd07d502745 Credits stealthcopter Required...

WordPress Visualizer Plugin <= 3.10.15 is vulnerable to SQL Injection

Software Visualizer Type Plugin Vulnerable versions = 3.10.15 Fixed in 3.11.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-3750 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6418115de830 Credits Krzysztof Zając Required privilege Subscriber...

WordPress Exclusive Addons Elementor Plugin <= 2.6.9.6 is vulnerable to Cross Site Scripting (XSS)

Software Exclusive Addons Elementor Type Plugin Vulnerable versions = 2.6.9.6 Fixed in 2.6.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4618 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3341f0baa50a Credits wesley...

WordPress VikBooking Hotel Booking Engine & PMS Plugin < 1.6.8 is vulnerable to Insecure Direct Object References (IDOR)

Software VikBooking Hotel Booking Engine & PMS Type Plugin Vulnerable versions 1.6.8 Fixed in 1.6.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-2441 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 7959a03a58d4...

WordPress SP Project & Document Manager Plugin <= 4.71 is vulnerable to Insecure Direct Object References (IDOR)

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.71 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-3748 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 1c7d92437a35 Credits...

WordPress Advanced Custom Fields PRO Plugin < 6.2.10 is vulnerable to Local File Inclusion

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.2.10 Fixed in 6.2.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-34762 Patch priority Low CVSS severity Low 9.9 Developer Claim ownership PSID c63a5562f29a Credits Security audit Required privile...

WordPress The Events Calendar Plugin < 6.4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software The Events Calendar Type Plugin Vulnerable versions 6.4.0.1 Fixed in 6.4.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4180 Patch priority Medium CVSS severity Medium 7.1 Developer Liquid Web / StellarWP PSID 9ded0dc115b9 Credits Marc...

WordPress month name translation benaceur Plugin < 2.3.8 is vulnerable to Cross Site Scripting (XSS)

Software month name translation benaceur Type Plugin Vulnerable versions 2.3.8 Fixed in 2.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3634 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 56fcc55ec64a Credits Bob Matyas...

WordPress UnGallery Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software UnGallery Type Plugin Vulnerable versions = 2.2.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3582 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID a683aa770e00 Credits Bob Matyas Required privileg...

WordPress HL Twitter Plugin <= 2014.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

Software HL Twitter Type Plugin Vulnerable versions = 2014.1.18 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3629 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 106b877d04b5 Credits Bob Matyas Required...

WordPress LetterPress Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software LetterPress Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3590 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6967a7d78047 Credits SANU P.L Required privileg...

WordPress Magical Addons For Elementor Plugin <= 1.1.37 is vulnerable to Cross Site Scripting (XSS)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.37 Fixed in 1.1.38 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2923 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f23618a4eb9 Credits João G...

WordPress All-in-One Video Gallery Plugin <= 3.6.5 is vulnerable to Local File Inclusion

Software All-in-One Video Gallery Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.7.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-4670 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 402ad478bb5f Credits Ngô Thiên An ancorn Required...

CVE-2024-34426

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5...

WordPress DethemeKit For Elementor Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software DethemeKit For Elementor Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34575 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0b69cc11bc19 Credits 4rCanJ0x! Required privilege...

WordPress plugin Brozzme Scroll Top 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

WordPress Simple Basic Contact Form Plugin <= 20240502 is vulnerable to Broken Access Control

Software Simple Basic Contact Form Type Plugin Vulnerable versions = 20240502 Fixed in 20240511 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4144 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e272f8f841f7 Credits...

WordPress Sydney Toolbox Plugin <= 1.31 is vulnerable to Cross Site Scripting (XSS)

Software Sydney Toolbox Type Plugin Vulnerable versions = 1.31 Fixed in 1.32 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4473 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1fd3834832c Credits Ngô Thiên An ancorn Require...

WordPress Borderless Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Borderless Type Plugin Vulnerable versions = 1.5.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34757 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6690481ece90 Credits Khalid Yusuf Required privilege Contributor...